Are companies responsible for the security of their digital services and products, and to what extent?